Security issues such as preventing unwelcome network interlopers or hackers are more pronounced in wireless networks. Whereas a wired network can secure its network attachment points in locked offices, the transmission medium is available to anyone with an antenna in a wireless network. To prevent unauthorized network access, a number of mechanisms have been developed for wireless network access control. In this control, a network port or node takes one of two roles: authenticator or supplicant. The supplicant seeks network access from the authenticator (typically, the network's access point (AP)). The authenticator enforces authentication according to some protocol. For example, the 802.11 specification stipulates two mechanisms for authenticating wireless LAN clients: open authentication and shared key authentication.
Open authentication is a bit of a misnomer as it refers to a default state in which a wireless network's access point (AP) will grant any request for authentication it receives. The sole “authentication” applied during open authentication is that the wireless supplicant supplies its MAC address. In addition, a wireless supplicant seeking authentication must have the network's Service Set Identifier (SSID). Because the SSID is easily “sniffed” by wireless interlopers, open authentication provides very little security for a wireless network.
Another authentication mechanism stipulated by the 802.11 specification is shared key access. Under shared key access, a wireless supplicant proves knowledge of a shared secret key before an AP grants network access. Because a network administrator or user must configure the supplicant with the secret key, implementation of shared key access is cumbersome. In addition, the transmission of the secret key by the wireless supplicant to the authenticator/AP may be compromised by “man-in-the-middle” and other sophisticated hacking techniques.
To address these weaknesses in the authentication mechanisms stipulated in the 802.11 specification, more powerful authentication frameworks are defined by the 802.1x specification. In general, the wireless supplicant is required to establish an authorized identity in these authentication techniques. Having established its identity, the wireless supplicant may then be provisioned with the security parameters needed to access the network. Although these more refined authentication techniques provide better network security, the credential provisioning by the authenticator/credential provisioner tends to be burdensome to administrate. To avoid this burden on users and network administrators, some wireless security systems use a power limitation during the credential provisioning process that requires the wireless supplicant to be within a restricted range of the provisioner. But such power limitation approaches are impractical for relatively heavy and immobile wireless supplicants such as wireless printers. Accordingly, there is a need in the art for improved wireless network credential provisioning procedures that provide enhanced network security yet are simple to administer.
Embodiments of the present invention and their advantages are best understood by referring to the detailed description that follows. It should be appreciated that like reference numerals are used to identify like elements illustrated in the figures.